CVE-2026-81682
MediumCVSS 6.2Summary
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
Risk Assessment
The risk is unauthorized access to decrypted data by other local users, potentially leading to leakage of sensitive information.
Recommendation
Upgrade to version 1.4.9, which sets secure file permissions, and review existing files created by the GUI for excessive permissions.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.